Date: Thu, 21 Jun 2001 14:05:53 -0500 (CDT) From: Nick Rogness <nick@rogness.net> To: Chuck Rock <carock@epctech.com> Cc: freebsd-ipfw@FreeBSD.ORG Subject: Re: Natd and IPFW ( I think I've asked before with no help)... Message-ID: <Pine.BSF.4.21.0106211344080.13834-100000@cody.jharris.com> In-Reply-To: <001801c0fa68$7c955c80$1805010a@epconline.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 21 Jun 2001, Chuck Rock wrote: > We are deploying FreeBSD firewalls with NATD running as well. > > Problem 1. > We have aliased real IP's on an interface, but natd.cf only lets us > forward ports from the original interface IP, not from the aliased > IP's. So we have to like four network cards and multiple firewalls to > accomplish the desired routing of ports by real IP address to internal > private IP's. > > Has anyone fixed this, or come up with a better solution? I'm not clear on what you are saying here. alias_address option of nat will let you specify your outside address...it doesn't have to be bound to any interface. redirect_address works like Static NAT if that is what you want. Please Clarify what you mean...from the outside to the inside OR from the inside to the outside? > > Problem 2. > We also use Portsentry, and when we forward ports with natd, they > forward BEFORE portsentry can see them. So if we have an internal > machine as a mail server, and forward a real IP to an internal IP for > port 25, but we use portsentry to watch traffic on that real IP, it > never sees portscans on IP because natd never passes the packets that > don't match the forwarding to the level that Portsentry is watching. Hmmm, not sure what to do here. I'm not sure how PortSentry works. If it uses BPF to watch traffic it should work, so it must not use that... Is Port sentry listening on the outside interface? > > Would running natd from rc.local aleviate this? Is that possible? > That has nothing to do with it. That just deals with loading progams when booting the system. ANd yes, you can start natd from rc.local. Nick Rogness <nick@rogness.net> - Keep on Routing in a Free World... "FreeBSD: The Power to Serve!" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0106211344080.13834-100000>